CVE-2026-89268
QloApps through 1.7.0 Reflected XSS via List Filter Parameters
CVSS Score
5.4
EPSS Score
0.0%
EPSS Percentile
0th
QloApps through 1.7.0 renders back-office list filter POST parameters into HTML input value attributes without escaping them in the list helper template. Attackers can induce authenticated users to submit crafted POST requests with malicious payloads to list controllers, executing arbitrary JavaScript in the victim's session to read administrative data and perform actions.
| CWE | CWE-79 |
| Vendor | webkul |
| Product | qloapps |
| Published | Sep 12, 2026 |
| Last Updated | Sep 14, 2026 |
Stay Ahead of the Next One
Get instant alerts for webkul qloapps
Be the first to know when new medium vulnerabilities affecting webkul qloapps are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
Required
Scope
Changed
Confidentiality
Low
Integrity
Low
Availability
None
Affected Versions
Webkul / QloApps
0 ≤ 1.7.0
References
github.com: https://github.com/Qloapps/QloApps/pull/1801 github.com: https://github.com/Qloapps/QloApps/commit/153ec1c8567798bd99155098ecc0a340e38f25bf github.com: https://github.com/Qloapps/QloApps/blob/v1.7.0/admin/themes/default/template/helpers/list/list_header.tpl github.com: https://github.com/Qloapps/QloApps vulncheck.com: https://www.vulncheck.com/advisories/qloapps-through-1.7.0-reflected-xss-via-list-filter-parameters
Credits
leediay153